According to Censys data, 33.5 million PHP services worldwide are running on affected versions. In Turkey, 92.9% of services that disclose their version are in the risky category.
Cybersecurity company Censys has published a live dashboard tracking the global impact and patching process of the security vulnerabilities known as PHP2Shell. According to the data on the panel, since the tracking began on October 21, the number of services detected using affected PHP versions has reached 41,433,822. Recent scans show that 33,500,304 services are still using an affected PHP version.
Tens of Millions of Services on Outdated Versions
The company detected that 7,943,892 services have transitioned to a patched version since October 21. Of these, 7,241,171 were seen with a patched version within the last 24 hours. However, these figures do not directly indicate the number of affected servers or organizations. Since a single server can host multiple websites, each service is considered a separate record.
Approximately 79.8% of the 41.9 million PHP services scanned in the last nine days that disclose their version information fall into the affected versions category. Of these, 8.5 million have moved to a patched version. Around 10 million services are using versions for which a patch has been released but not yet updated, while 23 million services are running on PHP 8.1 or older versions.
However, Censys states that not all detected PHP services disclose their version information. Therefore, the actual scope of the incident could be greater than what Censys data suggests.
Rate in Turkey is 92.9%
According to Censys's country-specific data, 364,237 PHP services in Turkey are among the affected versions. This number corresponds to 92.9% of PHP services originating from Turkey that disclose their version information. Turkey ranks 19th among 233 countries and regions in the country ranking based on the number and proportion of affected services.
Of course, these data do not mean that all websites or servers in Turkey are vulnerable to attack. Censys's classification is based on PHP versions reported in scans. Since Linux distributions can apply security fixes retroactively without changing the PHP version number, some systems may appear as affected versions even if they are actually up-to-date. Therefore, these figures represent an estimate of the current situation, not the exact number of systems with verified vulnerabilities.
How Did the PHP2Shell Vulnerability Emerge?
The security issue, named PHP2Shell, consists of two critical vulnerabilities tracked with codes CVE-2026-109618 and CVE-2026-109619. The vulnerabilities stem from errors in PHP's memory management and, under appropriate conditions, can allow attackers to execute remote code without authentication. This poses serious security risks, such as accessing files and databases on affected servers. Both vulnerabilities were assigned a severity rating of 9.2 out of 10.
The vulnerabilities were discovered with contributions from Calif and Wiz researchers during work conducted under OpenAI's Patch the Planet initiative. Security researchers utilized AI-powered tools to uncover long-unnoticed issues in PHP. The vulnerabilities were publicly disclosed on October 21, 2026, while the PHP team simultaneously released new versions containing security fixes.
However, following the disclosure, attack attempts also came to light. AWS reported detecting an exploitation attempt from an anonymous IP address on a honeypot system on October 17, four days before the announcement. Cloudflare also observed attack attempts that began before the announcement and rapidly increased afterward. These developments highlighted that system administrators should not delay updates after security vulnerabilities are published.
The PHP team released versions PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address the vulnerabilities. Since no official security updates are provided for PHP 8.1 and older branches, systems using these versions need to be migrated to a supported PHP version.
0 Comments: